Fix reconciliation intake during synchronous renders

Summary

Drain reconciliation events while the synchronous pipeline renders. The coordinator now has a leader-term-owned intake mailbox instead of leaving its subscription unread until the render finishes.

Each uninterrupted trigger run retains exactly the previous coalescing semantics: the first forced trigger, otherwise the latest ordinary trigger. Every render-gate verdict remains a FIFO boundary, so later renders observe its settled auxiliary-file baseline. No debounce timer, buffer increase, lossy subscription, validation bypass, or change to critical-drop handling.

Reproduction and mechanism

The archived 5,000-route scale run for !1768 (merged) passed its measured gates, but bulk teardown overflowed the coordinator's 1,000-slot subscription at 20:24:53 UTC, after steady-state measurement ended at 20:24:23. The critical-drop safeguard canceled the iteration; resource application and deployment then reported cancellation errors, and the other replica became leader.

TestCoordinatorDrainsTriggersDuringRender reproduces the intake defect on current main 7e7479355, without the status-delta change: while a mock pipeline is held blocked, queued triggers cannot drain (real make test exit 2). The fixed test submits 4,096 triggers in batches while rendering stays blocked, verifies that intake drains, and checks zero critical drops. Cancellation must also remove the subscription and join the intake goroutine.

The mailbox is coordinator-specific because its forced-trigger priority and gate boundaries differ from the shared latest-wins component mailbox. It is created only after leadership acquisition and stopped before that subscription is removed.

Review also found that a canceled waiter could pop a queued gate verdict through the intake-finished branch. A controlled-wakeup regression reproduces this on 07e4a48d0 (Make exit 2). The branch now rechecks cancellation before popping; normally closed input still drains.

Verification

• make lint audit: passed.
• Focused race tests: 40 passed, including the blocked-render and canceled-wakeup regressions, preserved gate boundaries, first-forced priority, a 10,000-trigger bounded run, every gate verdict retained, and normally closed input.
• Full make test: exit 0; 10,090 race-enabled tests with seven existing conditional skips, plus 1,022 playground tests. Lint and audit passed on the same source.
• Fresh-cluster HAProxy 3.4 E2E at four controller CPUs: exit 0, main package 589.953 s; owned cluster removed.
• Combined 5,000-route run with !1768 (merged): runner exit 0 and all measured gates passed, from clean archived commit 57bc9b46e / source 968e7bcfde7e on a fresh owned HAProxy 3.4 cluster. Ramp 913.137 s, steady 600.012 s; cluster removed.
• Whole-run controller-log audit: no errors, critical event drops, or controller-iteration restart. Bulk teardown no longer reproduces the coordinator failure. Six resource-applier mailbox warnings at depth 256 remain at 00:52:19–00:52:36 UTC, after the steady window ended at 00:51:45. This is not a warning-free lifecycle verdict. The resource-application scheduling redesign is approved as a separate change; it is not a prerequisite of this verified intake correction.